@iowarp/clio-coder 0.4.3 → 0.4.5

package/dist/chunk-5PSMVOLM.js

@@ -1,56 +0,0 @@
-import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
-import {
-  asDirectoryPathBoundary,
-  pathBoundaryEntryCovers,
-  resolvePathBoundary
-} from "./chunk-HHV2GANA.js";
-import {
-  init_esm_shims
-} from "./chunk-3R73A4XB.js";
-
-// src/domains/safety/scope.ts
-init_esm_shims();
-import path from "node:path";
-function normalizeRoot(root) {
-  return resolvePathBoundary(process.cwd(), root);
-}
-function isSubset(worker, orchestrator) {
-  for (const action of worker.allowedActions) {
-    if (!orchestrator.allowedActions.has(action)) return false;
-  }
-  for (const root of worker.allowedWriteRoots) {
-    const covered = orchestrator.allowedWriteRoots.some(
-      (outer) => pathBoundaryEntryCovers(normalizeRoot(outer), normalizeRoot(root))
-    );
-    if (!covered) return false;
-  }
-  if (worker.allowNetwork && !orchestrator.allowNetwork) return false;
-  if (worker.allowDispatch && !orchestrator.allowDispatch) return false;
-  return true;
-}
-var READONLY_SCOPE = {
-  allowedActions: /* @__PURE__ */ new Set(["read"]),
-  allowedWriteRoots: [],
-  allowNetwork: true,
-  allowDispatch: false
-};
-var WORKSPACE_SCOPE = {
-  allowedActions: /* @__PURE__ */ new Set(["read", "write", "execute", "dispatch"]),
-  allowedWriteRoots: [asDirectoryPathBoundary(path.resolve(process.cwd()))],
-  allowNetwork: true,
-  allowDispatch: true
-};
-var CONFIRMED_SCOPE = {
-  allowedActions: /* @__PURE__ */ new Set(["read", "write", "execute", "dispatch", "system_modify"]),
-  allowedWriteRoots: [asDirectoryPathBoundary(path.resolve(process.cwd()))],
-  allowNetwork: true,
-  allowDispatch: true
-};
-
-export {
-  isSubset,
-  READONLY_SCOPE,
-  WORKSPACE_SCOPE,
-  CONFIRMED_SCOPE
-};
-//# sourceMappingURL=chunk-5PSMVOLM.js.map

package/dist/chunk-7DICMOS6.js

@@ -1,313 +0,0 @@
-import { createRequire as __clioCreateRequire } from "node:module"; const require = __clioCreateRequire(import.meta.url);
-import {
-  isProjectVerifierCheckId
-} from "./chunk-UL3WSD3F.js";
-import {
-  SAFE_EXEC_DEFAULT_TIMEOUT_MS,
-  resolveSafeCwd
-} from "./chunk-JSC3U7TI.js";
-import {
-  require_dist
-} from "./chunk-APJ265NV.js";
-import {
-  __toESM,
-  init_esm_shims
-} from "./chunk-3R73A4XB.js";
-
-// src/tools/verify/catalog.ts
-init_esm_shims();
-var import_yaml = __toESM(require_dist(), 1);
-import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
-import path from "node:path";
-
-// src/domains/evidence/ordering.ts
-init_esm_shims();
-function compareCodepoints(left, right) {
-  return left < right ? -1 : left > right ? 1 : 0;
-}
-
-// src/tools/verify/catalog.ts
-var PROJECT_VERIFIER_CATALOG_RELATIVE_PATH = ".clio-coder/verifiers.yaml";
-var PROJECT_VERIFIER_CATALOG_VERSION = 1;
-var PROJECT_VERIFIER_CATALOG_CAPS = Object.freeze({
-  fileBytes: 256 * 1024,
-  checks: 128,
-  idBytes: 64,
-  descriptionBytes: 512,
-  argvEntries: 64,
-  argumentBytes: 4096,
-  cwdBytes: 512,
-  timeoutMs: 9e5,
-  tags: 16,
-  tagBytes: 32
-});
-var ROOT_FIELDS = /* @__PURE__ */ new Set(["version", "checks"]);
-var CHECK_FIELDS = /* @__PURE__ */ new Set(["id", "description", "command", "cwd", "timeoutMs", "tags"]);
-var TAG_PATTERN = /^[a-z0-9][a-z0-9._-]*$/;
-var SHELL_EXECUTABLES = /* @__PURE__ */ new Set([
-  "bash",
-  "cmd",
-  "command.com",
-  "dash",
-  "fish",
-  "ksh",
-  "powershell",
-  "pwsh",
-  "sh",
-  "tcsh",
-  "zsh"
-]);
-function isRecord(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
-}
-function utf8Bytes(value) {
-  return Buffer.byteLength(value, "utf8");
-}
-function hasControlCharacter(value) {
-  for (let index = 0; index < value.length; index += 1) {
-    const code = value.charCodeAt(index);
-    if (code <= 31 || code === 127) return true;
-  }
-  return false;
-}
-function catalogDiagnostic(message) {
-  return { ok: false, reason: `${PROJECT_VERIFIER_CATALOG_RELATIVE_PATH}: ${message}` };
-}
-function unknownFields(record, allowed) {
-  return Object.keys(record).filter((key) => !allowed.has(key)).sort(compareCodepoints);
-}
-function relativeCwd(workspaceRoot, resolved) {
-  const relative = path.relative(workspaceRoot, resolved);
-  return relative.length === 0 ? "." : relative.split(path.sep).join("/");
-}
-function safelyResolveCatalogCwd(rawCwd, workspaceRoot, location) {
-  if (path.isAbsolute(rawCwd) || path.win32.isAbsolute(rawCwd)) {
-    return new Error(`${location} must be repository-relative; absolute cwd '${rawCwd}' is not allowed`);
-  }
-  let resolved;
-  try {
-    resolved = resolveSafeCwd(rawCwd, workspaceRoot);
-  } catch {
-    return new Error(`${location} escapes the workspace root: '${rawCwd}'`);
-  }
-  let realCwd;
-  try {
-    const cwdStat = statSync(resolved);
-    if (!cwdStat.isDirectory()) return new Error(`${location} is not a directory: '${rawCwd}'`);
-    const realRoot = realpathSync(workspaceRoot);
-    realCwd = realpathSync(resolved);
-    resolveSafeCwd(realCwd, realRoot);
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    if (message.includes("escapes workspace root")) {
-      return new Error(`${location} escapes the workspace root through a symbolic link: '${rawCwd}'`);
-    }
-    return new Error(`${location} cannot be resolved as a repository directory: '${rawCwd}' (${message})`);
-  }
-  return { declared: relativeCwd(workspaceRoot, resolved), execution: realCwd };
-}
-function resolveProjectVerifierExecutionCwd(rawCwd, workspaceRoot) {
-  const resolution = safelyResolveCatalogCwd(rawCwd, workspaceRoot, "project check cwd");
-  return resolution instanceof Error ? resolution : resolution.execution;
-}
-function validateId(value, location) {
-  if (typeof value !== "string" || value.length === 0) return new Error(`${location} must be a non-empty string`);
-  if (utf8Bytes(value) > PROJECT_VERIFIER_CATALOG_CAPS.idBytes) {
-    return new Error(`${location} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.idBytes}-byte cap`);
-  }
-  if (!isProjectVerifierCheckId(value)) {
-    return new Error(`${location} must match /^[a-z0-9][a-z0-9._:-]*$/`);
-  }
-  if (value === "frontend") return new Error(`${location} uses reserved built-in check id 'frontend'`);
-  return value;
-}
-function validateDescription(value, location) {
-  if (typeof value !== "string" || value.length === 0) return new Error(`${location} must be a non-empty string`);
-  if (value.trim() !== value || hasControlCharacter(value)) {
-    return new Error(`${location} must be trimmed, single-line text without control characters`);
-  }
-  if (utf8Bytes(value) > PROJECT_VERIFIER_CATALOG_CAPS.descriptionBytes) {
-    return new Error(`${location} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.descriptionBytes}-byte cap`);
-  }
-  return value;
-}
-function validateCommand(value, location) {
-  if (!Array.isArray(value) || value.length === 0) {
-    return new Error(`${location} must be a non-empty argv string array; shell command strings are not allowed`);
-  }
-  if (value.length > PROJECT_VERIFIER_CATALOG_CAPS.argvEntries) {
-    return new Error(`${location} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.argvEntries}-entry cap`);
-  }
-  const command = [];
-  for (const [index, entry] of value.entries()) {
-    const entryLocation = `${location}[${index}]`;
-    if (typeof entry !== "string" || entry.length === 0) {
-      return new Error(`${entryLocation} must be a non-empty string`);
-    }
-    if (entry.includes("\0")) return new Error(`${entryLocation} must not contain a NUL byte`);
-    if (utf8Bytes(entry) > PROJECT_VERIFIER_CATALOG_CAPS.argumentBytes) {
-      return new Error(`${entryLocation} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.argumentBytes}-byte cap`);
-    }
-    command.push(entry);
-  }
-  const executable = command[0] ?? "";
-  if (/\s/u.test(executable)) {
-    return new Error(`${location}[0] must be one executable token, not a shell command string`);
-  }
-  const executableName = path.basename(executable).toLowerCase().replace(/\.exe$/u, "");
-  if (SHELL_EXECUTABLES.has(executableName)) {
-    return new Error(`${location}[0] may not invoke shell executable '${executable}'`);
-  }
-  return command;
-}
-function validateTimeout(value, location) {
-  if (!Number.isInteger(value) || typeof value !== "number" || value <= 0) {
-    return new Error(`${location} must be a positive integer number of milliseconds`);
-  }
-  if (value > PROJECT_VERIFIER_CATALOG_CAPS.timeoutMs) {
-    return new Error(`${location} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.timeoutMs}ms cap`);
-  }
-  return value;
-}
-function validateTags(value, location) {
-  if (!Array.isArray(value)) return new Error(`${location} must be an array of bounded tag strings`);
-  if (value.length > PROJECT_VERIFIER_CATALOG_CAPS.tags) {
-    return new Error(`${location} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.tags}-tag cap`);
-  }
-  const tags = [];
-  const seen = /* @__PURE__ */ new Set();
-  for (const [index, entry] of value.entries()) {
-    const entryLocation = `${location}[${index}]`;
-    if (typeof entry !== "string" || entry.length === 0) {
-      return new Error(`${entryLocation} must be a non-empty string`);
-    }
-    if (utf8Bytes(entry) > PROJECT_VERIFIER_CATALOG_CAPS.tagBytes) {
-      return new Error(`${entryLocation} exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.tagBytes}-byte cap`);
-    }
-    if (!TAG_PATTERN.test(entry)) return new Error(`${entryLocation} must match /^[a-z0-9][a-z0-9._-]*$/`);
-    if (seen.has(entry)) return new Error(`${location} contains duplicate tag '${entry}'`);
-    seen.add(entry);
-    tags.push(entry);
-  }
-  return tags;
-}
-function sourcePathInsideWorkspace(catalogPath, workspaceRoot) {
-  try {
-    const realRoot = realpathSync(workspaceRoot);
-    const realCatalogPath = realpathSync(catalogPath);
-    resolveSafeCwd(realCatalogPath, realRoot);
-    return realCatalogPath;
-  } catch (error) {
-    const message = error instanceof Error ? error.message : String(error);
-    return new Error(`catalog file must resolve inside the workspace root (${message})`);
-  }
-}
-function loadProjectVerifierCatalog(workspaceRoot) {
-  const catalogPath = path.join(workspaceRoot, PROJECT_VERIFIER_CATALOG_RELATIVE_PATH);
-  if (!existsSync(catalogPath)) return { ok: true, source: null };
-  const safeSourcePath = sourcePathInsideWorkspace(catalogPath, workspaceRoot);
-  if (safeSourcePath instanceof Error) return catalogDiagnostic(safeSourcePath.message);
-  let text;
-  try {
-    const stats = statSync(safeSourcePath);
-    if (!stats.isFile()) return catalogDiagnostic("catalog path must be a regular file");
-    if (stats.size > PROJECT_VERIFIER_CATALOG_CAPS.fileBytes) {
-      return catalogDiagnostic(`file exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.fileBytes}-byte cap`);
-    }
-    text = readFileSync(safeSourcePath, "utf8");
-  } catch (error) {
-    return catalogDiagnostic(`cannot read catalog (${error instanceof Error ? error.message : String(error)})`);
-  }
-  return parseProjectVerifierCatalogText(text, workspaceRoot, catalogPath);
-}
-function parseProjectVerifierCatalogText(text, workspaceRoot, catalogPath = path.join(workspaceRoot, PROJECT_VERIFIER_CATALOG_RELATIVE_PATH)) {
-  const document = (0, import_yaml.parseDocument)(text, { prettyErrors: false, strict: true, uniqueKeys: true });
-  if (document.errors.length > 0) {
-    return catalogDiagnostic(`invalid YAML: ${document.errors.map((error) => error.message).join("; ")}`);
-  }
-  let parsed;
-  try {
-    parsed = document.toJS({ maxAliasCount: 0 });
-  } catch (error) {
-    return catalogDiagnostic(`invalid YAML: ${error instanceof Error ? error.message : String(error)}`);
-  }
-  if (!isRecord(parsed)) return catalogDiagnostic("root must be an object with version and checks fields");
-  const rootUnknown = unknownFields(parsed, ROOT_FIELDS);
-  if (rootUnknown.length > 0) return catalogDiagnostic(`root has unknown field(s): ${rootUnknown.join(", ")}`);
-  if (!Object.hasOwn(parsed, "version")) return catalogDiagnostic("root.version is required");
-  if (parsed.version !== PROJECT_VERIFIER_CATALOG_VERSION) {
-    return catalogDiagnostic(
-      `unsupported version ${JSON.stringify(parsed.version)}; supported version is ${PROJECT_VERIFIER_CATALOG_VERSION}`
-    );
-  }
-  if (!Object.hasOwn(parsed, "checks")) return catalogDiagnostic("root.checks is required");
-  if (!Array.isArray(parsed.checks)) return catalogDiagnostic("root.checks must be an array");
-  if (parsed.checks.length > PROJECT_VERIFIER_CATALOG_CAPS.checks) {
-    return catalogDiagnostic(`root.checks exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.checks}-check cap`);
-  }
-  const sourceRef = { kind: "project-catalog", path: catalogPath };
-  const checks = [];
-  const ids = /* @__PURE__ */ new Map();
-  for (const [index, value] of parsed.checks.entries()) {
-    const location = `checks[${index}]`;
-    if (!isRecord(value)) return catalogDiagnostic(`${location} must be an object`);
-    const checkUnknown = unknownFields(value, CHECK_FIELDS);
-    if (checkUnknown.length > 0) {
-      return catalogDiagnostic(`${location} has unknown field(s): ${checkUnknown.join(", ")}`);
-    }
-    for (const field of CHECK_FIELDS) {
-      if (!Object.hasOwn(value, field)) return catalogDiagnostic(`${location}.${field} is required`);
-    }
-    const id = validateId(value.id, `${location}.id`);
-    if (id instanceof Error) return catalogDiagnostic(id.message);
-    const duplicateIndex = ids.get(id);
-    if (duplicateIndex !== void 0) {
-      return catalogDiagnostic(`${location}.id duplicates '${id}' from checks[${duplicateIndex}].id`);
-    }
-    const description = validateDescription(value.description, `${location}.description`);
-    if (description instanceof Error) return catalogDiagnostic(description.message);
-    const command = validateCommand(value.command, `${location}.command`);
-    if (command instanceof Error) return catalogDiagnostic(command.message);
-    if (typeof value.cwd !== "string" || value.cwd.length === 0) {
-      return catalogDiagnostic(`${location}.cwd must be a non-empty repository-relative string`);
-    }
-    if (value.cwd.includes("\0")) return catalogDiagnostic(`${location}.cwd must not contain a NUL byte`);
-    if (utf8Bytes(value.cwd) > PROJECT_VERIFIER_CATALOG_CAPS.cwdBytes) {
-      return catalogDiagnostic(`${location}.cwd exceeds the ${PROJECT_VERIFIER_CATALOG_CAPS.cwdBytes}-byte cap`);
-    }
-    const cwdResolution = safelyResolveCatalogCwd(value.cwd, workspaceRoot, `${location}.cwd`);
-    if (cwdResolution instanceof Error) return catalogDiagnostic(cwdResolution.message);
-    const cwd = cwdResolution.declared;
-    const timeoutMs = validateTimeout(value.timeoutMs, `${location}.timeoutMs`);
-    if (timeoutMs instanceof Error) return catalogDiagnostic(timeoutMs.message);
-    const tags = validateTags(value.tags, `${location}.tags`);
-    if (tags instanceof Error) return catalogDiagnostic(tags.message);
-    ids.set(id, index);
-    checks.push({ id, description, command, cwd, timeoutMs, tags, source: { ...sourceRef } });
-  }
-  checks.sort((left, right) => compareCodepoints(left.id, right.id));
-  return { ok: true, source: { ...sourceRef, checks } };
-}
-function packageDeclaredCheck(id, packagePath, cwd, tags) {
-  return {
-    id,
-    description: `Run package.json script '${id}'.`,
-    command: ["npm", "run", id],
-    cwd,
-    timeoutMs: SAFE_EXEC_DEFAULT_TIMEOUT_MS,
-    tags,
-    source: { kind: "package.json", path: packagePath }
-  };
-}
-
-export {
-  compareCodepoints,
-  PROJECT_VERIFIER_CATALOG_RELATIVE_PATH,
-  PROJECT_VERIFIER_CATALOG_VERSION,
-  PROJECT_VERIFIER_CATALOG_CAPS,
-  resolveProjectVerifierExecutionCwd,
-  loadProjectVerifierCatalog,
-  parseProjectVerifierCatalogText,
-  packageDeclaredCheck
-};
-//# sourceMappingURL=chunk-7DICMOS6.js.map